[spv2] Account for flipped writing modes in paint offset

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index b215ab15b4383a7d77e484f80a95c6c899f813be..dba877e5fbd228b86a083dd8ffc5f2fbd413f52b 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -345,14 +345,17 @@ static void deriveBorderBoxFromContainerContext(const LayoutObject& object, Pain
         ASSERT_NOT_REACHED();
     }
     if (boxModelObject.isBox()) {
-        context.paintOffset += toLayoutBox(boxModelObject).locationOffset();
+        // TODO(pdr): Several calls in this function walk back up the tree to calculate containers
+        // (e.g., topLeftLocation, offsetForInFlowPosition*). The containing block and other
+        // containers can be stored on PaintPropertyTreeBuilderContext instead of recomputing them.
+        context.paintOffset.moveBy(toLayoutBox(boxModelObject).topLeftLocation());
         // This is a weird quirk that table cells paint as children of table rows,
         // but their location have the row's location baked-in.
         // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
         if (boxModelObject.isTableCell()) {
             LayoutObject* parentRow = boxModelObject.parent();
             ASSERT(parentRow && parentRow->isTableRow());
-            context.paintOffset -= toLayoutBox(parentRow)->locationOffset();
+            context.paintOffset.moveBy(-toLayoutBox(parentRow)->topLeftLocation());
         }
     }
 }